PT-2025-13257 · Mesop · Mesop
Published
2025-03-27
·
Updated
2025-03-27
·
CVE-2025-30358
CVSS v3.1
8.1
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Mesop versions prior to 0.14.1
Description
A class pollution vulnerability in Mesop allows attackers to overwrite global variables and class attributes in certain Mesop modules during runtime, potentially leading to a denial of service (DoS) attack against the server. This issue could also result in severe consequences, such as identity confusion, where an attacker could impersonate an assistant or system role within conversations, potentially enabling jailbreak attacks when interacting with large language models (LLMs). The vulnerability could manipulate the intended data-flow or control-flow of the application at runtime, leading to severe consequences like remote code execution when gadgets are available.
Recommendations
For versions prior to 0.14.1, upgrade to version 0.14.1 to obtain a fix for the issue. As a temporary workaround, consider restricting access to sensitive modules and functions to minimize the risk of exploitation. Avoid using vulnerable class attributes and global variables in the affected Mesop modules until the issue is resolved.
Exploit
Fix
DoS
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Mesop